| Descripción: | Summary:
The remote host is missing an update to php5
announced via advisory DSA 2195-1.
Vulnerability Insight:
Stephane Chazelas discovered that the cronjob of the PHP 5 package in
Debian suffers from a race condition which might be used to remove
arbitrary files from a system (CVE-2011-0441).
When upgrading your php5-common package take special care to _accept_
the changes to the /etc/cron.d/php5 file. Ignoring them would leave the
system vulnerable.
For the oldstable distribution (lenny), this problem has been fixed in
version 5.2.6.dfsg.1-1+lenny10.
For the stable distribution (squeeze), this problem has been fixed in
version 5.3.3-7+squeeze1.
For the unstable distribution (sid), this problem has been fixed in
version 5.3.6-1.
Additionally, the following vulnerabilities have also been fixed in the
oldstable distribution (lenny):
CVE-2010-3709
Maksymilian Arciemowicz discovered that the ZipArchive class
may dereference a NULL pointer when extracting comments from a zip
archive, leading to application crash and possible denial of
service.
CVE-2010-3710
Stefan Neufeind discovered that the FILTER_VALIDATE_EMAIL filter
does not correctly handle long, to be validated, strings. Such
crafted strings may lead to denial of service because of high memory
consumption and application crash.
CVE-2010-3870
It was discovered that PHP does not correctly handle certain UTF-8
sequences and may be used to bypass XSS protections.
CVE-2010-4150
Mateusz Kocielski discovered that the imap extension may try to
free already freed memory when processing user credentials, leading
to application crash and possibly arbitrary code execution.
Solution:
We recommend that you upgrade your php5 packages.
CVSS Score:
6.8
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
